Microsoft AZ-305 Practice Exam

• A. An Azure Policy assignment with the Deny effect
• B. A CanNotDelete resource lock on the resource group Correct answer
• C. A custom Azure RBAC role that has no delete permissions
• D. Azure Backup for the resources in the group

Option B is correct because a CanNotDelete resource lock blocks deletion for everyone, including Owners, while leaving read and modify permissions intact. Azure Policy Deny (A) governs resource configuration at create or update time and does not stop deletion, a custom role (C) would change the users' permissions, and Azure Backup (D) only enables recovery.

• A. One Log Analytics workspace per geography, using the resource-context access mode Correct answer
• B. One workspace in West Europe for all subscriptions, with table-level Azure RBAC for each team
• C. One workspace per geography, using workspace-context access and a saved query pack for each team
• D. One workspace per application team in its subscription's region, using workspace-context access

Option A is correct because one workspace per geography keeps EU data in the EU and keeps the workspace count small, and resource-context access lets each team query only the logs of resources it has Azure RBAC access to. A single West Europe workspace (B) breaks data residency, query packs (C) do not restrict access, and a workspace per team (D) multiplies workspaces and gives workspace-wide access.

• A. A single metric alert rule scoped to the subscription and region, covering all VMs Correct answer
• B. A Resource Health alert rule on the virtual machine resource type in the subscription
• C. A scheduled query alert rule over the Perf table in a Log Analytics workspace, split by computer
• D. One metric alert rule per VM, deployed from a shared ARM template

Option A is correct because a metric alert rule can be scoped to a whole subscription and region and evaluate every VM's platform CPU metric with one rule, at no ingestion cost. Resource Health alerts (B) do not track CPU, a log query over the Perf table (C) needs an agent and workspace ingestion that are not in place, and one rule per VM (D) is more effort to manage.

• A. Stream through Event Hubs to an Azure Data Explorer cluster retaining 7 years
• B. Keep 90 days interactive, set total retention to 7 years, and query older data with search jobs Correct answer
• C. Set interactive retention to 7 years on every table
• D. Export to a storage account with immutability, and a lifecycle rule moving blobs to archive

Option B is correct because keeping 90 days interactive and setting total retention to 7 years puts older data in low-cost long-term retention, and search jobs let auditors run KQL over it occasionally, all inside Log Analytics. Interactive retention for 7 years (C) costs far more, and Azure Data Explorer (A) or storage export (D) add another service to operate and do not support KQL in place.

• A. Azure Function action that restarts the App Service plan through the Azure Resource Manager API
• B. Automation Runbook action that references the existing restart runbook Correct answer
• C. Event Hubs action that sends the alert payload to a hub that Teams reads
• D. Email action addressed to the operations team's distribution list
• E. Logic App action that runs a workflow posting the alert to the Teams channel Correct answer

Options B and E are correct because the Automation Runbook action runs the existing restart runbook directly, and a Logic App action can run a workflow that posts the alert to the Teams channel. Option A would rebuild the restart logic instead of reusing the existing runbook, option C needs a custom reader for Teams, and option D only sends email, which meets neither requirement.

• A. Azure SQL Database single database
• B. SQL Server on Azure Virtual Machines
• C. Azure SQL Managed Instance Correct answer
• D. Azure SQL Database elastic pool

Option C is correct because Azure SQL Managed Instance is the PaaS offering with near-complete SQL Server engine compatibility, including SQL Server Agent and cross-database queries, while Microsoft manages the OS. A single database and an elastic pool lack Agent and cross-database support, and SQL Server on a VM requires you to manage the operating system.

• A. Send report connections to the built-in readable replica using read-only application intent Correct answer
• B. Copy the database to a second server nightly with a scheduled pipeline and report from the copy
• C. Scale the database up to more vCores so the reports and checkout share the extra capacity
• D. Create an active geo-replica in the paired region and point the reports at it

Option A is correct because Business Critical databases include a built-in readable secondary replica at no extra cost, and connecting with read-only application intent offloads reports from the primary with seconds of lag. A nightly copy adds pipeline effort and stale data, scaling up still shares resources with checkout, and a geo-replica adds cost and cross-region latency.

• A. Provision each database as a single database at its own peak vCore size
• B. Place the databases in an elastic pool sized for their combined load Correct answer
• C. Merge the tenants into one Hyperscale database with a schema per tenant
• D. Use serverless single databases with auto-pause enabled for every tenant

Option B is correct because an elastic pool lets many isolated databases with non-overlapping spikes share one pool of resources sized for the combined load, which is cheaper than sizing each for its own peak. Merging tenants into one database loses per-tenant isolation, and serverless auto-pause is a poor fit for constant light load and can add resume latency.

• A. Set ReadWrite host caching on the disk that holds the transaction log
• B. Use Standard SSD disks for the log file to avoid premium disk cost
• C. Put tempdb on a premium SSD data disk with ReadWrite host caching
• D. Set ReadOnly host caching on the premium SSD disks that hold data files Correct answer
• E. Place tempdb on the VM's local temporary SSD Correct answer

Options D and E are correct because ReadOnly host caching on premium SSD data-file disks speeds up reads, and tempdb belongs on the VM's local temporary SSD for the lowest latency. Option A is wrong because the log disk should use no host caching, option B is wrong because log files need premium or faster disks, and option C is wrong because ReadWrite caching is not recommended for SQL Server disks.

• A. Allow the app's outbound IP addresses in the server firewall and keep a SQL user for the app
• B. Create a contained database user for the web app's managed identity Correct answer
• C. Store a SQL login password in Key Vault and reference it from the app settings
• D. Register a service principal and keep its client secret in an App Service setting
• E. Set an Entra group as the server's Microsoft Entra admin and add the DBAs to it Correct answer

Options B and E are correct because a contained database user for the app's managed identity removes any password or secret from the configuration, and an Entra group set as the server's Microsoft Entra admin lets DBA access follow group membership. Options A, C and D all still depend on a SQL password or a client secret, which the policy forbids.

• A. Azure Backup Server writing to a Recovery Services vault, restoring the VMs in Azure tier by tier when needed
• B. Azure Migrate server migration with continuous replication, cutting over each tier in sequence on the day
• C. Azure Backup with the MARS agent on each VM, restoring files into new Azure VMs after a disaster
• D. Azure Site Recovery with a recovery plan that starts the database, application and web tiers in order Correct answer

Option D is correct because Azure Site Recovery replicates Hyper-V VMs to Azure and a recovery plan lets you order groups so the database starts before the application and web tiers, with little administrative effort. Azure Backup and MARS (A, C) only restore data after the fact and cannot orchestrate an ordered failover, and Azure Migrate (B) is a one-time migration tool, not a DR service.

• A. Add a geo-replica in the paired region and create a monthly database copy that is kept for 10 years
• B. Raise PITR retention to 35 days and export a BACPAC to immutable blob storage each month with an Azure Automation runbook
• C. Set PITR retention to 21 days and add a long-term retention policy that keeps the monthly backup for 10 years Correct answer
• D. Protect the database with an Azure Backup policy in a Recovery Services vault that keeps monthly recovery points for 10 years

Option C is correct because Azure SQL Database has built-in automated backups: PITR retention can be set to 21 days and a long-term retention policy can keep the monthly backup for 10 years, with no jobs to run. A geo-replica plus copies (A) and BACPAC exports via runbook (B) are manual work, and Azure Backup with a Recovery Services vault (D) does not protect Azure SQL Database.

• A. Configure log shipping to a standby server in East US 2 with backup, copy and restore jobs running every 5 minutes
• B. Replicate every VM, database VMs included, to East US 2 with Site Recovery and fail over using the latest crash-consistent recovery points
• C. Back up the database with Azure Backup log backups every 15 minutes to a GRS vault and use Cross Region Restore in the paired region
• D. Add an asynchronous-commit Always On availability group replica in East US 2 and fail the web tier over with Site Recovery Correct answer

Option D is correct because an asynchronous-commit availability group replica streams log records continuously, meeting an RPO under a minute and a fast failover, while the stateless web tier needs only Site Recovery. Site Recovery crash-consistent points (B) cannot reliably give a sub-minute RPO for a heavily written database, and log shipping every 5 minutes (A) or log backups every 15 minutes (C) leave a much larger data-loss window.

• A. Associate the existing North Europe public IP with the West Europe load balancer in a recovery plan post-action
• B. Pre-create the West Europe virtual network and map the source network to it so replicated NICs land in matching subnets Correct answer
• C. Enable zone redundancy on the North Europe load balancer frontend so the same address stays reachable in a regional outage
• D. Give the partners the West Europe address now so they allow-list it next to the North Europe address Correct answer
• E. Reserve a Standard public IP in West Europe on a pre-built load balancer that the replication settings use as the target Correct answer
• F. Front the gateway with a Traffic Manager priority profile so the partners keep connecting to the same DNS name

Options B, D and E are correct. Site Recovery needs the target network mapped in advance (B), and the partners need the West Europe address before the event, which is possible because they agreed to allow-list one more address (D). Reserving a Standard public IP on a pre-built West Europe load balancer and using it as the replication target means the failover brings the gateway up on an already trusted address with no portal steps (E). A public IP cannot be moved across regions, zone redundancy does not survive a regional outage, and a Traffic Manager name does not help partners who allow-list IP addresses.

• A. Azure Service Health alert rules on each vault that report the outcome of every backup job
• B. Azure Advisor reliability recommendations, exported each quarter as the job and retention report
• C. Azure Business Continuity Center, to see protected and unprotected resources across every subscription and vault Correct answer
• D. The Microsoft Defender for Cloud regulatory compliance dashboard, which stores the job history of each vault
• E. Vault diagnostic settings that stream to a Log Analytics workspace, with Backup Reports for job and retention history Correct answer

Options C and E are correct. Azure Business Continuity Center gives one view of protected and unprotected resources across subscriptions and vaults, and vault diagnostic settings that stream to Log Analytics feed Backup Reports for job and retention history. Service Health reports platform incidents rather than backup job outcomes, Advisor gives recommendations and not job history, and Defender for Cloud does not store vault job history.

• A. Azure Container Instances groups started by a Logic App schedule
• B. Azure Container Apps on the Consumption plan Correct answer
• C. AKS with the cluster autoscaler enabled
• D. Azure Service Fabric managed cluster

Option B is correct because Azure Container Apps on the Consumption plan is a serverless container platform that runs stateless HTTP services, scales on HTTP traffic including to zero replicas, and needs no cluster management. AKS (C) and Service Fabric (D) both require operating a cluster, and scheduled Container Instances groups (A) add custom orchestration and do not scale on request traffic.

• A. AKS cluster with a Spot node pool and a custom job controller that resubmits evicted pods
• B. Azure Batch pool of dedicated VMs backed by three-year reservations
• C. Azure Batch pool of Spot VMs with an autoscale formula that sizes the pool from pending tasks Correct answer
• D. Flexible-orchestration scale set of Spot VMs with a scheduler VM that tracks task state

Option C is correct because Azure Batch is the managed service for splitting a job into independent tasks, and Spot VMs give the lowest compute price for tasks that can safely be restarted if a node is evicted. Batch requeues evicted tasks automatically and an autoscale formula sizes the pool from pending tasks. The AKS and scale set options (A, D) require custom scheduling code, and dedicated VMs with reservations (B) pay for capacity that sits idle between nightly jobs.

• A. AKS Automatic cluster hosting the vendor chart and the 12 services together Correct answer
• B. AKS Standard with user-managed node pools, the cluster autoscaler and a monthly upgrade window
• C. Azure Container Apps for every workload, with the vendor chart repackaged as a custom container image
• D. Azure Container Apps for the 12 services and a separate small AKS cluster for the vendor operator

Option A is correct because the vendor ships a Helm chart that installs an operator and custom resource definitions, which requires a real Kubernetes API, and AKS Automatic is the AKS mode where Azure manages node provisioning, scaling, patching and upgrades for a small team. Azure Container Apps (C, D) does not support Helm charts, operators or CRDs, so repackaging the chart is not viable. AKS Standard (B) leaves node pool and upgrade management with the two engineers.

• A. Run CoreDNS and other add-ons on a tainted system node pool, with applications on user node pools Correct answer
• B. Taint the GPU node pool and give the inference pods a matching toleration and node selector Correct answer
• C. Add GPU VM sizes to the existing node pool and let the cluster autoscaler place pods wherever capacity exists
• D. Deploy the inference service to a second AKS cluster built from GPU nodes
• E. Run the inference pods on virtual nodes backed by Azure Container Instances

Options A and B are correct because a tainted system node pool keeps CoreDNS and other add-ons isolated from application resource exhaustion, and a taint on the GPU pool plus a matching toleration and node selector on the inference pods reserves the costly GPU nodes for that workload only. Option C lets any pod land on GPU nodes, a second cluster (D) adds needless operational overhead, and virtual nodes backed by ACI (E) do not provide controlled, dedicated GPU node placement.

• A. A constrained-vCPU variant of a memory-optimized size, exposing 8 vCPUs with the memory of the full size Correct answer
• B. A 1 TiB Premium SSD P30 data disk with on-demand bursting enabled to cover the 60,000 IOPS
• C. A memory-optimized 32-vCPU size, with Oracle instance caging used to limit the database to 8 CPUs
• D. A Premium SSD v2 data disk with 60,000 IOPS provisioned separately from its 1 TiB capacity Correct answer
• E. Twelve 1 TiB Premium SSD P30 disks striped in the guest to reach 60,000 IOPS in aggregate

Options A and D are correct because a constrained-vCPU size keeps the full memory of the larger VM while exposing only 8 vCPUs for Oracle licensing, and Premium SSD v2 lets you provision 60,000 IOPS independently of the 1 TiB capacity at the lowest storage cost. A single P30 (B) is limited to 5,000 provisioned IOPS with only temporary bursting, Oracle instance caging on a 32-vCPU VM (C) does not reduce the vCPU count Oracle licenses on Azure, and striping twelve P30 disks (E) pays for 12 TiB of capacity that is not needed.